fix(ci): add gateway test step and remove silent Python install fallback - #3
Open
deensaleh wants to merge 1 commit into
Open
Conversation
Two CI gaps that let failures go undetected: Bug 1 — gateway-mcp has 170 tests but CI never ran them. The gateway job built the package but had no Test step. Policy engine tests, bypass attack tests, classifier tests, anomaly detection tests — all 170 were completely invisible to CI. Silent regressions in security-critical code could ship undetected. Fix: add 'npm test' step after the build step in the gateway job. All 170 tests pass. Bug 2 — Python SDK install swallowed errors silently. 'pip install -e ".[dev]" 2>/dev/null || pip install -e .' hides real installation failures. If [dev] extras fail for a legitimate reason (missing dep, version conflict), the fallback masks it and CI reports success on a broken install. Fix: use 'pip install -e ".[dev]"' directly. The dev extras install cleanly — agentguard-core-schema is published on PyPI.
Justin0504
added a commit
that referenced
this pull request
Jun 22, 2026
…r scripts Closes the loop on the four 'next steps' from last commit, with the caveat that #1-#3 still depend on the user running a single script that compresses their work to one command. ── 4. Control-plane UI (apps/control-plane/) ── 7 new files. Full signup → API key reveal → cockpit dashboard flow, plus a self-serve billing page that hits Stripe Checkout. Pages: / Landing — 'Create an org' / 'Sign in' shell /signup Form: email + password + org name → POST /api/auth/signup → provisionTenant() → cookie set, redirect to /welcome /login Form: email + password → POST /api/auth/login → cookie set → /dashboard /welcome Shows the freshly-minted API key EXACTLY ONCE (sessionStorage, cleared on continue). Includes Python + JS code snippets pre-filled with a truncated version of the key. /dashboard Lists user's orgs with quotas + 'Open cockpit →' button that points at https://<slug>.aegis.dev /billing 4-card pricing grid with monthly/annual toggle. Pro / Team CTAs → POST /api/billing/checkout → Stripe Checkout redirect. API routes: POST /api/auth/signup create user + tenant + api_key (atomic) POST /api/auth/login verify + set aegis_session cookie GET /api/me current user + their orgs (cookie-auth) POST /api/tenants (already shipped, kept for completeness) POST /api/billing/checkout (already shipped) POST /api/stripe/webhook (already shipped) ALL /api/gw/[...path] (already shipped) Style: globals.css — monochrome shell with prefers-color-scheme dark variant. Matches cockpit visual language so the handoff at 'Open cockpit →' is seamless. ── 1. setup-homebrew-tap.sh ── Compresses the 3-step Homebrew bootstrap into one command: 1. gh repo create Justin0504/homebrew-aegis 2. Walks user through fine-grained PAT creation (manual step) 3. gh secret set HOMEBREW_TAP_PAT 4. Smoke-tests the PAT against the tap repo Then `git push --tags` triggers the auto-PR flow. ── 2. setup-saas-dev.sh ── Spins up the full SaaS stack on localhost — no Supabase / Stripe / Cloudflare account needed for the first dev loop: - docker run aegis-saas-pg (Postgres 16, port 54330) - apps/control-plane/.env.local generated with sane defaults - npm install + npm run migrate - Prints the two-terminal run commands (gateway + control plane) After running this you can: open http://localhost:14000 and walk the signup → welcome → dashboard flow end-to-end. ── 3. quick-screenshot.sh ── For the marketing-site screenshot capture work. Resizes Chrome to 1440x900 via osascript, walks through 6 URLs one at a time, prompts for ⌘⇧4, picks the newest ~/Desktop/Screenshot*.png after each capture and renames it into apps/marketing/public/screenshots/ with the canonical name. Then sed-flips USE_PLACEHOLDERS=false. Three commands user can run on their own time: ./scripts/setup-homebrew-tap.sh ./scripts/setup-saas-dev.sh ./scripts/quick-screenshot.sh
Justin0504
added a commit
that referenced
this pull request
Jul 5, 2026
Continues the white-bg + real-brand-logo pattern into three surfaces: #1 Trace details header (48px) Header used to lead with the agent name and no visual anchor for the tool being called. Now: 48px brand disc + tool_name (mono) + "by <agent>" subtitle. Same disc as the traces list but scaled up so the detail view reads like a Datadog APM span header instead of a log line. #3 Violation row (26 → 40px) Restructures each violation card to lead with a 40px brand disc, then tool_name (mono, bold) + risk chip + "by <agent>" on one line, then the summary / policy / timestamp beneath. The tool is the actual thing being audited, so it deserves to be the heading — the agent moves to a subtitle. Dropped the redundant small risk dot under the icon (risk chip already carries that info). #4 Cost panel — new "Cost by Tool" section Existing "Cost by Model" answers "which LLM vendor is billing me" (grey bar chart, monospace model names). New section answers "which downstream services are my agents actually spending inference on": top-8 tools by cost, each row = 22px brand disc + tool_name + call count + $ + mini bar. "+N more tools not shown" footer when there are more. Gateway (traces.ts): - /stats/cost now returns `by_tool` alongside `by_agent_model`. tool_name lives inside the tool_call JSON blob, so we group via SQLite's json_extract (JSON1 extension, always compiled in). NULL tool_names (malformed / legacy blobs) collapse into a single '(unknown)' bucket rather than being dropped — matches how ToolIcon fallback works. Tests: 94 suites / 1190 tests green, gateway + cockpit build clean. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two CI gaps that let failures go undetected:
Bug 1 — gateway-mcp has 170 tests but CI never ran them. The gateway job built the package but had no Test step. Policy engine tests, bypass attack tests, classifier tests, anomaly detection tests — all 170 were completely invisible to CI. Silent regressions in security-critical code could ship undetected.
Fix: add 'npm test' step after the build step in the gateway job. All 170 tests pass.
Bug 2 — Python SDK install swallowed errors silently. 'pip install -e ".[dev]" 2>/dev/null || pip install -e .' hides real installation failures. If [dev] extras fail for a legitimate reason (missing dep, version conflict), the fallback masks it and CI reports success on a broken install.
Fix: use 'pip install -e ".[dev]"' directly. The dev extras install cleanly — agentguard-core-schema is published on PyPI.